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" Th9 MAILING DATE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C, § 133). 

- Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1704(b). 

Status 

1 )IE Responsive to communication(s) filed on 18 September 2000 . 
2a)n This action is FINAL. 2b)l3 This action is non-final. 

3) n Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under £x parte Quay/e, 1935 CD. 11, 453 O.G. 213. 
Disposition of Claims 

4) H Claim(s) 7-74 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) n Claim(s) is/are allowed. 

6) S Claim(s) 7-74 is/are rejected. 
?)□ Claim(s) is/are objected to. 

8) n Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) S The specification is objected to by the Examiner. 

10) 13 The drawing(s) filed on 18 September 2000 is/are: a)S accepted or b)^ objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 

11) 0 The proposed drawing correction filed on is: a)n approved b)n disapproved by the Examiner 

If approved, connected drawings are required in reply to this Office action. 

12) 0 The oath or declaration is objected to by the Examiner. 
Priority under 35 U.S.C. §§119 and 120 

13) 0 Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (0- 

a)nAII b)n Some*c)n None of: 

1 .□ Certified copies of the priority documents have been received. 

2. n Certified copies of the priority documents have been received in Application No. . 

3. n Copies of the certified copies of the priority documents have been received in this National Stage 

application from the Intemational Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 

14) 0 Acknowledgment is made of a claim for domestic priority under 35 U.S.C, § 1 19(e) (to a provisional application). 

a) □ The translation of the foreign language provisional application has been received. 

15) 0 Acknowledgment is made of a claim for domestic priority under 35 U.S.C. §§ 120 and/or 121. 

Attachnrient(s) 

1 ) [3 Notice of References Cited (PTO-892) 4) EH Interview Summary {PTO-41 3) Paper No(s). . 

2) □ Notice of Draftsperson's Patent Drawing Review (PTO-948) 5) □ Notice of Informal Patent Application (PTO-1 52) 

3) (3 Information Disclosure Statement(s) (PTO-1449) Paper No(s) 2. 6) □ Other: 
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DETAILED ACTION 



Pursuant to USC 131, claims 1-14 are presented for examination. 



Specification 



2. The disclosure is objected to because of the following informalities: on page 6, line 22, 
"computer figurations" should be replaced with ~ computer configurations — . On page 7, 
line 16, "cache buffer memory 30" should be replaced with — cache buffers 20 — . 
Appropriate correction is required. 

Claim Objections 

3. Claim 5 is objected to because of the following informalities: on line 13, the second "is" 
should be replaced with — if ~, 



4. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or 
composition of matter, or any new and useful improvement thereof, may obtain a patent 
therefor, subject to the conditions and requirements of this title. 

Claims 9 and 12 and the intervening claims are rejected under 35 U.S.C. 101 because 
the claimed invention is directed to non-statutory subject matter. The computer program product 
cited in these claims is not embodied in a computer hardware. 



Claim Rejections - 35 USC §101 
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Claim Rejections - 35 USC § 103 



5. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or 
described as set forth in section 102 of this title, if the differences between the subject matter 
sought to be patented and the prior art are such that the subject matter as a whole would have 
been obvious at the time the invention was made to a person having ordinary skill in the art to 
which said subject matter pertains. Patentability shall not be negatived by the manner in which 
the invention was made. 

5. 1 Claims 1-8 are rejected under 35 U.S.C. 103(a) as being unpatentable over US Patent 
5,398,196 to Chambers in view of US Patent 5,649,095 to Cozza and in view of AAPA 
(Applicant Admitted Prior Art). 

5.2 As per claim 1, Chambers substantially teaches a method for optimizing the operation 
of an anti-virus computer program for use with an operating system, comprising the steps of 
detecting a request for closure of an opened computer file and determining in response to a 
closure request if the opened computer file has been modified since being opened (see column 
10, lines 7-14). Chambers does not explicitly disclose the step of scanning said opened file for 
viruses before closure only if said opened file has been modified and closing said file if 
unmodified, and closing said file after scanning for viruses if found virus free. It is known in the 
art as AppUcant Admitted Prior Art discloses that the opened file is scanned for viruses before 
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closure and closing said file after scanning for viruses if found virus free (see prior art figure 2). 
Cozza in an analogous art teaches the step of scanning said file for viruses only if file has been 
modified and skip scanning if unmodified (see column 4, lines 4-17). Therefore, it would have 
been obvious to one of ordinary skill in the art at the time the invention was made to modify the 
method of Chambers to include the step of scanning said opened file for viruses before closure 
only if said opened file has been modified and closing said file if unmodified, and closing said 
file after scanning for viruses if found virus free as taught by Cozza to guarantee a great 
scanning speed increase. This modification would have been obvious because one skilled in the 
art would have been motivated by the suggestions provided by Cozza so as to guarantee a great 
scanning speed increase. 

As per claim 2, Chambers discloses the Umitation of determining whether said 
operating system includes a "dirty cache buffer" to raise or set a modification flag relative to a 
file being modified during the time it has been open, a computer code being indicative of said 
flag, and using the computer code for a raised or set modification flag, if available, for carrying 
out said modification determining step by checking for the presence of a raised modification for 
said file (see column 10, lines 7-14 and see column 9, Unes 1 1-60). 

As per claim 3, Chambers discloses the limitation of if it's determining that said 
operating system does not provide a modification flag, said method fiirther includes the steps of 
establishing a "dirty cache buffer" to raise a modification flag if and opened file associated with 
said flag has being modified by a write operation (see column 3, line 64 through column 4, line 
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3). Chambers discloses that the program also has means of executing the steps of the above 
claim 2 on its own. 

As per claim 4, Chambers discloses the limitation of wherein said operating system 
includes a "dirty cache buffer for providing a computer code for a modification flag indicative of 
the modification of an open file, said method further including in said modification determining 
step of detecting the presence of said modification flag to determine if the associated file has 
been modified (see column 10, lines 7-14 and see column 9, hnes 1 1-60). 

As per claim 5, Chambers substantially teaches the claimed method of claim 4. 
Chambers does not explicitly disclose the step of claim 5. It is known in the art as Applicant 
Admitted Prior Art discloses that the opened file is scanned for viruses before closure and 
closing said file after scanning for viruses if found virus free (see prior art figure 2). Cozza in an 
analogous art teaches the step of establishing a cache buffer memory for storing upon opening of 
a file only a virus vulnerable portion of that file that a virus must use to enter and infect said file; 
said modification determining step including the steps of indicating an open file is unmodified in 
the absence of an associated modification flag; responding to the presence of a modification flag 
by comparing a portion of said open file to the associated unmodified virus vulnerable portion of 
said file in said cache buffer memory to determine if the portion of the open file has been 
modified since the opening of the file indicating the opened file is unmodified if the virus 
vulnerable portion is unmodified and modified if the portion is modified (see column 6, lines 21- 
45). Therefore, it would have been obvious to one of ordinary skill in the art at the time the 
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invention was made to modify the method of Chambers to apply the storage step as taught by 
Cozza to guarantee a great scanning speed increase. This modification would have been obvious 
because one skilled in the art would have been motivated by the suggestions provided by Cozza 
so as to guarantee a great scanning speed increase. 

As per claim 6, Chambers discloses the limitation of monitoring if a write was initiated 
for a given open file (see column 6, lines 34-59). Chambers does not disclose a network 
environment- It is apparent to one skilled in the art that the invention can be implemented in a 
network environment as to monitoring network protocols. 

As per claim 7, Chambers substantially teaches a method for optimizing the operation 
of an anti- virus program in an operating system, said operating system including programming 
for raising a flag indicative of modification of an open file during the time the file has been open 
said method including the steps of detecting the event of a request for closing said file being 
made to said operating system determining whether said modification flag has been raised by 
said operating system for said file (see column 10, lines 7-14 and see column 9, lines 1 1-60). 
Chambers does not explicitly disclose the step of scanning said opened file for viruses before 
closure only if said opened file has been modified and skipping scanning before closing of said 
file if unmodified. Cozza in an analogous art teaches the step of scanning said open file in 
response to said modification flag, for permitting said operating system to close said file; and 
skipping said step of scanning for viruses before closure of said open file whenever said 
modification flag is not present (see column 4, lines 4-17). Therefore, it would have been 
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obvious to one of ordinary skill in the art at the time the invention was made to modify the 
method of Chambers to include the step of canning said open file in response to said 
modification flag, for permitting said operating system to close said file; and skipping said step 
of scanning for viruses before closure of said open file whenever said modification flag is not 
present as taught by Cozza to guarantee a great scanning speed increase. This modification 
would have been obvious because one skilled in the art would have been motivated by the 
suggestions provided by Cozza so as to guarantee a great scanning speed increase. 

Claim 8 is similar to claims 5 and 7. Therefore, claim 8 is rejected on the same rationale 
as the rejection of claims 5 and 7. 

6. Claims 9-14 are rejected under 35 U.S.C. 103(a) as being unpatentable over US Patent 
5,319,776 to Hile et al. in view of US Patent 5,649,095 to Cozza. 

6. 1 As per claim 9, Hile et aL substantially teaches a computer program for detecting 
computer viruses on a file server, the file server providing file storage and retrieval services for 
at least one client computer over a network, said computer program product comprising: 
computer code for detecting an open request fi*om a client computer, the open request asking for 
a requested file from the server (see column 6, lines 5-39); computer code for scanning said 
requested file for computer viruses, whereby the file server is permitted to provide said requested 
file to the client computer if no computer viruses are found therein (see column 6, line 66 
through column 7, Hne 6); computer code for detecting a close request from the cHent computer 
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associated with said requested file (see column 7, lines 23-24); scanning said requested file for 
computer viruses if said requested file was changed prior to said close request (see column 7, 
lines 24-27). Hile et al. does not explicitly disclose the step of skipping scanning said requested 
file if it was not changed prior to said close request. Cozza in an analogous art teaches the step 
of accessing an operating system flag that indicates whether the requested file was changed prior 
to said close request; scanning said requested file for computer viruses if said requested file was 
changed prior to said close request; and skipping scanning said requested file if it was not 
changed prior to said close request (see column 4, lines 4-17 and column 6, lines 21-45). 
Therefore, it would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify the method of Hile et al. to include the step of skipping scanning as taught 
by Cozza to guarantee a great scanning speed increase. This modification would have been 
obvious because one skilled in the art would have been motivated by the suggestions provided by 
Cozza so as to guarantee a great scanning speed increase. 

Claim 12 recites the same hmitation as the rejected claim 9 except for the step of 
determining whether a virus vulnerable portion has been modified which is disclosed by Cozza. 
Therefore, claim 12 is rejected on the same rationale as the rejection of claim 9. 

As per claims 10 and 13, Hile et aL discloses the limitation of wherein said operating 
system flag is generated externally to said computer program product by the operating system in 
order to reduce redundant disk writes, whereby said computer code for scanning is invoked upon 
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closing of the requested file only when actual disk writes are made by the operating system for 
the requested file (see column 6, lines 28-39; see also figure 6a). 

As per claims 11 and 14, Hile et aL discloses the limitation of wherein said computer 
code for accessing uses a file handle generated by the operating system to identify the operating 
system flag corresponding to the requested file, said handle having been generated when the file 
was opened (see column 6, lines 28-39; see also figure 6a). 

Conclusion 

7. The prior art made of record and not reUed upon is considered pertinent to applicant's 
disclosure. 

a. US Patent 5,956,481 Walsh et al. 

This patent pertains to a computer system for protecting data files residing on a computer 
fi*om infection by a computer virus. 

b. US Patent 6,330,648 Wambachetal. 

This patent pertains to a method of preventing overwriting in memory in the presence of 
a virus in the computer memory. 

7. 1 Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Carl Colin whose telephone number is 703-305-0355. The 
examiner can normally be reached on Monday through Thursday, 8:00-6:30 PM. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on 703-305-9648. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 

Any inquiry of a general nature or relating to the status of this application or proceeding 
should be directed to the receptionist whose telephone number is 703-305-3900. 



Carl Colin 



Patent Examiner 



' AYAZ SHEIKH 
SUPERVISORY PATENT EXAMINER 
TECHNOLOGY CENTER 2100 




February 22, 2004 



